CVI Smart Contracts Review
Audit · firm’s term: smart contract review
Zokyo reviewed CVI (CVI Smart Contracts Review) on 30 Nov 2023: 16 findings, 0 critical; 15 marked fixed, 1 open.
Trustblock does not review code.
Findings16
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 3 |
| Low | 1 | 0 | 12 |
MediumInconsistent CVI value handling during the deposit in MegaThetaVault contractFixed
The report gives no description here.
MediumMissing Checks For Whether Arbitrum Sequencer Is ActiveFixed
The report gives no description here.
MediumPossible price manipulation due to dependency on manipulable spot priceFixed
The report gives no description here.
LowApprove amount 0 for tokens to previously used routers/ managersFixed
The report gives no description here.
LowAvoid using transfer for sending the native tokenFixed
The report gives no description here.
LowIncorrect Comment LineFixed
The report gives no description here.
LowLack of events in the implementation of privileged functionsFixed
The report gives no description here.
LowMethod setPlatform does not check if the new platform is the same old platformFixed
The report gives no description here.
LowMissing _disableInitializer() implementationFixed
The report gives no description here.
LowNo address(0) checkFixed
The report gives no description here.
Show 5 more
LowNo need to initialize default valuesFixed
The report gives no description here.
LowUnsafe cast from int256 to uint256Fixed
The report gives no description here.
LowUnused importFixed
The report gives no description here.
LowUnvalidated referral codes allow users to claim undeserved affiliate benefitsFixed
The report gives no description here.
LowUse specific Solidity compiler versionFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (31)
- CVIOracle.sol
- FeesCollector.sol
- PositionRewards.sol
- VolatilityTokenV3.sol
- PlatformRequestFulfillerV3.sol
- MegaThetaVault.sol
- ThetaVaultV3Manager.sol
- PlatformMigrator.sol
- HedgedThetaVault.sol
- Platform.sol
- ThetaVault.sol
- FeesCalculator.sol
- KeepersBased.sol
- ReferralManager.sol
- UCVIOracle.sol
- ThetaVaultRequestFulfillerV3.sol
- LowLatencyRequestFulfiller.sol
- Liquidation.sol
- UniswapV3LiquidityManager.sol
- VolatilityToken.sol
- Rebaser.sol
- VolatilityTokenRequestFulfillerV3.sol
- CVIReverseOracle.sol
- ThetaVaultV3.sol
- KeepersFeeVault.sol
- UniswapHelper.sol
- RequestFulfiller.sol
- RebaserV3.sol
- ETHVolOracle.sol
- PlatformHelper.sol
- Treasury.sol
Part of CVI’s security record
CVISecurity firm
Zokyo89 projects reviewed · 131 reports · latest Feb 2025
See Zokyo’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us